Public Key Pinning Boosts Website Security

In the effort to mitigate man-in-the-middle (MITM) attacks, which uses fraudulent SSL certificates, the Public Key Pinning Extension for HTTP (HPKP) has been designed, in order to create a more reliable method of approving a Web server's digital certificate. HPKP permits a site administrator to put up a certificate authority's (CA) public key or certificate to their server's certificate and send the data in an HTTP header. This enables browsers and other apps to see that a server's certificate is approved and signed by a specific whitelisted CS, rather than depending on a chain verification certificate to validate it. The certificate verification stage of the connection is used to carry out the check, prior to any data being sent by the browser.

Google Chrome has been supporting Public Key Pinning for some time now and it has helped in detecting fraudulent SSL certificate issued by DigiNotar, employed in a MITM attack against Google users in Iran and as intermediate CA certificates wrongly issued by TurkTrust. These lapses in the CA infrastructure are sabotaging the confidence in the CA hierarchy of trust. This is the main reason why important browsers are embracing certificate pinning. Besides, public key pinning is supported by Firefox and Google Chrome, Microsoft is also considering it for inclusion in Internet Explorer and a new Web browser, Spartan.

Firefox and Chrome involve a built-in pinset – a list of certificates that are acceptable for big, high security websites – but as of now, no browsers are supporting dynamic pinsets. This means that the list of agreeable certificate authorities for every pinned domain has to be re-loaded at the time of application build-in. This brings in scalability issues and removes all but the major websites. With the help of website application security services, Both vendors try and look at how well dynamic pinsets have to be supported. Web administrators who want to prepare their websites for dynamic pinning have to return the Public Key Pins HTTP header, if their site is accessed over HTTPS. For example, the following header can be send through a web server, which tells the browsers to join a specific SSL certificate with a website.

Header set Public-Key-Pins "pin-sha256=\"base64+info1==\"; pin-sha256=\"backup+pin+here==\"; max-age=15768000; includeSubDomains" (Note: This requires enabling of apache mod_headers)

Including a pin for a backup certificate, which is not being used in production, is also a good practice. This assures that the site is accessible, even after the main certificate gets removed.

Visit Here : http://www.avyaan.com/services/web-application-audit.php

Application Security Testing Helps in Safeguarding Your Apps from Threats

 

Like any other program, a mobile app is also vulnerable to security threats. With the growth of a large number of apps, which require storing and sharing of critical data like bank details or credit card information, personal ID's, data related to health, or making transactions. Because of this, security testing for mobile applications has become essential. It is important to analyze the threat and to plan out how to defend your mobile app against it. Conducting a test without security awareness is not a good idea.

Third-party libraries and codes are used in most of the mobile apps that are developed today. Third-party support is usually related to security threats, against which an app is vulnerable. Even if an app developer is aware of such threats, the performance can be ruined due to the open source components of the app. It also has the capability of sinking the app in the market, even before it emerges. 

Why Should Enterprises Be Concerned?

According to Gartner reports, in 2015, more than 75 percent of apps will not clear security tests – in iOS, android and windows platforms, as the fundamental business related security standards are lacking. The consequences are huge for enterprises as policies are at risk of being breached with critical business related data.

App Security Vulnerabilities

Usage of open source codes for non-core differentiating features is a customary practice and is openly accepted in the process of app development. Time and resources are saved over coding for elements that are non-essential in the app. Therefore, developers cannot ignore guiding third-party libraries and codes, as a part of app development. It is important to grasp the issues and license restrictions related with third-party codes, in order to understand the kind of security exposure faced by your app. A broad-based vulnerability database is created when you register to security updates, which directs towards the category of security threat that is applicable to your app, and checks for reported security concerns. Security threats that go unreported are related to proprietary code extensions or technological evolution, which can cause serious problems in application technology.

Third-Party Open Source Components Security Checklist

Automated testing tools like software security testing should be used to conduct the testing. The app developer should be fully aware of third-party open source components like security ramifications and issues on app users and apps. Capability with third-party party codes make sure that app developer takes complete responsibility of the security issues that are related to it and prohibits hacking by taking care of security flaws and app vulnerabilities.

Read more : https://storify.com/aahnajain1/software-security-for-expansion-of-your-business#publicize

Handling Security Issues, Slowing the Internet of Things

The potential of the Internet of Things (IoT) is becoming increasingly exiting for the IT industry, but this excitement carries a hidden danger, according to a report from HP.

HP is not the only one voicing concerns: FTC in the US is taking a closer look at the IoT and Ofcom in UK is investigating a framework for the technology, so that it develops in ways that is benefiting for consumers.

HP's concern is that, as soon as one security issue is solved by the IT industry, it moves on to create another one.

In a recent article, HP's Daniel Miessler states 'It seems that every time we introduce a new space in IT we lose 10 years from our collective security knowledge,'. Daniel Miessler heads the research team at HP Fortify on Demand and is a leader in OWASP Internet of Things Top 10 Project. He further says, 'Around 10 years ago we started talking about applications being the horizon technology, and we proceeded to build a global application portfolio ignoring the security lessons learned from the network world'.

'Then, five years ago, we decided that mobile was the real place to be. So everyone started building mobile apps while ignoring everything we've learned from securing web and thick-client applications', he said.

The issue concerning him now is that if they continue with this trend, they will have a new space that ignores web application security as well as mobile security lessons, but it can get much worse than that.

IoT is not just considered a new insecure space, he said, 'It's a Frankenbeast of technology that links network, application, mobile and cloud technologies together into a single ecosystem, and it unfortunately seems to be taking on the worst security characteristics of each'.

In a recent IoT security report, HP Fortify on Demand surveyed 10 devices through multiple product types and found that on an average there are 20 vulnerabilities present in every system. These products spanned TV's, home automation hubs, thermostats and alarm systems.

In terms of dealing with these issues practically, Miessler points at the work of Open Web Application Security Project (OWASP), which has come up with 10 key issues. They are:

• Insecure web interfaces
• Insecure mobile interfaces
• Insufficient authentication and authorization
• Insecure cloud interfaces
• Insecure network services
• Privacy concerns
• Lack of transport encryption
• Insufficient allowance for security systems configuration
• Poor physical security
• Insecure firmware and software

 After considering the possible external threats, the next step is to look at internal weaknesses. For example, when weak passwords are used, an organization's authentication will not be sufficient. 

For more Website application security  visit @ http://www.avyaan.com/blog/security-practice-guidelines-owasp-wordpress-part-2/

How Protected Are Your Open Source Systems

Open source software security is a big responsibility. Open source is considered to be more secure than proprietary software, because more widely the open software is available, more closely it is examined. And, the more flaws that surface, the stronger a code becomes.

This would be true if the components, which make up the open source code are constantly analyzed and if web application security services are verified by the developers, before they are incorporated into their work.

But, this is not always the case. Similar to automobile assembly plants, which uses independently manufactured brake components and airbags for building cars, software developers also assume that their supply chain open source components are up to date, patched and reliable.

Regrettably, assumptions like these allow vulnerabilities similar to those that were present in the Heartbleed bug.

There are a number of reasons why flaws exist in the open source system: the components when used for the first time might be old, or they might not have been appropriately tested. But usually, an open source component that makes it into a broadly used application is assumed to be safe, therefore, diminishing the demand for testing.

Be Aware of What's in Your Software

The inventory of open source components is crucial, because without that, IT managers will not be able to know if the system has compromised components. One way of checking is through Application Health Check, which provides free breakdown of each component and also alerts IT managers of likely licensing and security problems.

When there is a defect in the open source, it's revealed, but if you are not aware of the problems in your software, that revelation may tip of enemies who can use it to exploit vulnerabilities. And hackers get immense benefit by going after the components, which are extensively used, such as Heartbleed attck/OpenSSL demonstrated.

Following are the ways for agencies to ensure that their systems uses a secure software supply chain.

Usage of best ingredients: Agencies should ensure that the components used are coming directly from a trusted archive. Search for software that is compatible with CVE (Common Vulnerabilities and Exposures). These are a set of standard identifiers known for exposures and security vulnerabilities.

Make a list – IT managers should device and secure a bill of materials, for the components that are used in a piece of software.

Scan the code – Automated code scanners, which are compatible with SCAP (Security Content Automation Protocol), should be used.

Government-certified software should be used – Using cryptography libraries that are FIPS-certified, for writing encryption applications, eliminates the need of obtaining additional FIPS-certification.

Protect Your Business With mobile Security Services @ http://www.avyaan.com/blog/checklist-data-mobile-app-security/

How to Perform Successful Security Audits

One of the most important security measures in Information Technology is web application security audits. They are not just one-time measures, but something that should be done by an organization at least annually. Even if your network security was perfect last year, it is not necessary for it to remain the same way, as hackers keep coming up with new tools and there may be a new mistake that your company made. In some industries, the audit requirements are spelled out by the federal regulations. You can decide how you want to run the audit, in case no regulations apply. 

 Following are some of the best ways you can conduct a security web application security audits :

Hire an Auditor

Hiring an outside auditor is one of the best ways of going about a security check. An outsider may be able to spot weaknesses that your in-house IT staff missed out. Experienced computer-security professionals who are aware of exactly what to look for, prove to be good auditors. You should set specific goals in order to get the maximum out of an auditor. An annual audit will be able to pick up every possible vulnerability. During audits, you may also be able to accomplish smaller objectives such as examining a new firewall's performance.

Prepare for an Audit

A big part of making an audit successful is preparing for the audit. The cost of an audit has to be build into the budget and it has to be scheduled for a time when critical operations will not be interfered with. Someone on your staff should be able to take responsibility of the project, work with the auditor and stay informed about the audit regulations of your firm. Once the auditor arrives, present her with all the documentation – IT procedures, policies and flow diagrams in a single docket.

Making an Assessment and Finding Solutions

Assessing your security, identifying the problem and analyzing them properly, is the first step in the audit process. This includes looking at network weaknesses, as well as weaknesses in the operating system and software. The assessment also includes looking at the security of your network when employees have access to it from home, and also if someone sets up a convenient network bypass.

A good auditor will not only identify problems, but will also tell you the solution. The solution can differ from replacing your firewall, to changing the password policies. Critical issues need to be fixed at once, other changes are not urgent and can be fixed slowly.

For more security information visit here http://www.avyaan.com/